{"id":248467,"date":"2026-11-04T00:30:08","date_gmt":"2026-11-04T00:30:08","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/"},"modified":"2026-11-04T00:30:10","modified_gmt":"2026-11-04T00:30:10","slug":"sample-phishing-site","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/","title":{"rendered":"Sample Phishing Site: What a Fake Login Page Looks Like"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>A sample phishing site is a fake web page built to look like a bank, retailer, email provider or workplace login, so you type your credentials into it. The page itself is often a near-perfect copy. The clues are usually in the address bar, in how you arrived, and in what the page asks you to do. This guide walks through illustrative examples, the warning signs to check, how to practice safely, and what to do if you already entered something.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Protect Your Logins From Phishing<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">Explore LogMeOnce resources on password management and identity security to help protect your accounts from fake login pages.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#What_a_sample_phishing_site_looks_like\" >What a sample phishing site looks like<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Four_illustrative_examples\" >Four illustrative examples<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Example_1_the_%E2%80%9Cyour_package_is_held%E2%80%9D_page\" >Example 1: the \u201cyour package is held\u201d page<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Example_2_the_workplace_single_sign-on_clone\" >Example 2: the workplace single sign-on clone<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Example_3_the_clone_of_a_message_you_really_received\" >Example 3: the clone of a message you really received<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Example_4_the_account-security_alert\" >Example 4: the account-security alert<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Warning_signs_on_the_page_and_in_the_message\" >Warning signs on the page and in the message<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#1_Look_at_the_domain_not_the_page\" >1. Look at the domain, not the page<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#2_Ask_how_you_got_there\" >2. Ask how you got there<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#3_Notice_the_emotional_push\" >3. Notice the emotional push<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#4_Check_what_the_page_asks_for\" >4. Check what the page asks for<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#5_Verify_through_a_channel_you_control\" >5. Verify through a channel you control<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#How_to_tell_a_fake_login_from_a_real_one_in_ten_seconds\" >How to tell a fake login from a real one in ten seconds<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Perspective_why_the_domain_check_should_not_rest_on_you_alone\" >Perspective: why the domain check should not rest on you alone<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Using_phishing_examples_and_simulations_safely\" >Using phishing examples and simulations safely<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#If_you_already_entered_information_on_a_suspicious_site\" >If you already entered information on a suspicious site<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Where_a_password_manager_and_MFA_fit\" >Where a password manager and MFA fit<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Choosing_a_plan_that_matches_your_risk\" >Choosing a plan that matches your risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Is_it_legal_to_build_a_sample_phishing_site_for_training\" >Is it legal to build a sample phishing site for training?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Does_a_padlock_icon_mean_a_site_is_safe\" >Does a padlock icon mean a site is safe?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Can_I_be_harmed_just_by_opening_a_phishing_page\" >Can I be harmed just by opening a phishing page?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Where_can_I_report_a_phishing_website\" >Where can I report a phishing website?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/logmeonce.com\/resources\/sample-phishing-site\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>A phishing site can copy the branding, layout and user experience of the real one, and the domain may be the only visible clue, <a href=\"https:\/\/www.netcraft.com\/blog\/10-real-examples-of-phishing-websites-screenshots\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">according to Netcraft<\/a>.<\/li>\n<li>Check the domain first, then how you got there. An unsolicited link plus an unfamiliar domain is enough reason to close the tab.<\/li>\n<li>Urgent, fear-based language and requests for personal or financial details are the classic <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">warning signs listed by CISA<\/a>. Bad grammar is no longer a reliable one.<\/li>\n<li>A password manager will not autofill on a domain it does not recognize, which turns a fake page into an obvious red flag.<\/li>\n<li>If you entered data, change the password, turn on multi-factor authentication (MFA), call your bank if money is involved, and report it to the FBI\u2019s IC3.<\/li>\n<\/ul>\n<h2 id=\"what-a-sample-phishing-site-looks-like\"><span class=\"ez-toc-section\" id=\"What_a_sample_phishing_site_looks_like\"><\/span>What a sample phishing site looks like<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Picture an email that says your streaming account is on hold. You click the button and land on a page with the right logo, the right colors, a familiar sign-in box and a footer with the usual links. Nothing looks off. That is the point.<\/p>\n<p>The U.S. Department of Health and Human Services <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">reports<\/a> that thousands of fraudulent websites are built every day to collect information, sell products that do not exist, or push malware, and that fake login pages mirror the branding and templates of the legitimate ones. The same alert notes that bad actors sell premade fake login sites on the dark web, so a scammer does not need design skill. They need a few dollars and a domain name.<\/p>\n<p>Netcraft\u2019s analysis of real phishing pages makes a similar point: <a href=\"https:\/\/www.netcraft.com\/blog\/10-real-examples-of-phishing-websites-screenshots\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">modern phishing kits<\/a> can replicate an organization\u2019s branding and experience so accurately that even security-conscious users may struggle to tell the difference. Some attackers do not even bother with code. Netskope <a href=\"https:\/\/www.netskope.com\/blog\/attackers-target-crypto-wallets-using-codeless-webflow-phishing-pages\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">observed<\/a> codeless phishing pages built on a website-builder platform, in some cases using a screenshot of the real homepage as the whole interface.<\/p>\n<p>So do not expect a sloppy page. Expect a convincing one, and look elsewhere.<\/p>\n<h2 id=\"four-illustrative-examples\"><span class=\"ez-toc-section\" id=\"Four_illustrative_examples\"><\/span>Four illustrative examples<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The addresses below are invented for teaching. They use the patterns that phishing sites commonly rely on, and none is a real site. The pattern of misusing domains the organization does not own, such as extra words, subdomains, character swaps or free hosting, is described by <a href=\"https:\/\/phishvoid.com\/blog\/phishing-site-examples\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishvoid<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th>Pattern<\/th>\n<th>Example address (invented)<\/th>\n<th>What gives it away<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Real brand placed in a subdomain<\/td>\n<td><code>bankname.secure-verify.example\/login<\/code><\/td>\n<td>The registered domain is <code>secure-verify.example<\/code>, not the bank. Everything before it is decoration.<\/td>\n<\/tr>\n<tr>\n<td>Extra words added<\/td>\n<td><code>bankname-account-update.example<\/code><\/td>\n<td>Real companies rarely run sign-in on a separate domain with \u201cupdate\u201d or \u201cverify\u201d in it.<\/td>\n<\/tr>\n<tr>\n<td>Character substitution<\/td>\n<td><code>paypa1.example<\/code> or <code>rnicrosoft.example<\/code><\/td>\n<td>A numeral 1 stands in for the letter l, and \u201crn\u201d imitates \u201cm\u201d.<\/td>\n<\/tr>\n<tr>\n<td>Free hosting or builder platform<\/td>\n<td><code>bankname-login.sites-builder.example<\/code><\/td>\n<td>A large brand would not host its sign-in page on a free page-builder subdomain.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The page that loads at each address could be pixel-identical to the real login. What differs is who owns the domain.<\/p>\n<h3 id=\"example-1-the-your-package-is-held-page\"><span class=\"ez-toc-section\" id=\"Example_1_the_%E2%80%9Cyour_package_is_held%E2%80%9D_page\"><\/span>Example 1: the \u201cyour package is held\u201d page<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A text message says a delivery failed and asks you to pay a small redelivery fee. The link opens a page with the carrier\u2019s logo and a payment form. The fee is tiny on purpose: the goal is your card number, not three dollars. Real carriers do not ask for card details through a link in an unexpected text.<\/p>\n<h3 id=\"example-2-the-workplace-single-sign-on-clone\"><span class=\"ez-toc-section\" id=\"Example_2_the_workplace_single_sign-on_clone\"><\/span>Example 2: the workplace single sign-on clone<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>An email appears to come from IT: your mailbox is almost full, sign in to keep it. The link leads to a clone of your company\u2019s sign-in page. After you type your password, it may bounce you to the real page so you think nothing happened. The trick is that the first attempt \u201cfailed\u201d and the second worked, so you move on.<\/p>\n<h3 id=\"example-3-the-clone-of-a-message-you-really-received\"><span class=\"ez-toc-section\" id=\"Example_3_the_clone_of_a_message_you_really_received\"><\/span>Example 3: the clone of a message you really received<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>You ordered something, got a genuine confirmation, and later receive a near-identical message saying the earlier one had a problem and a corrected link is inside. Attackers copy a real email and swap in a malicious link. Because the context is real, trust is high.<\/p>\n<h3 id=\"example-4-the-account-security-alert\"><span class=\"ez-toc-section\" id=\"Example_4_the_account-security_alert\"><\/span>Example 4: the account-security alert<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A page warns that someone signed in to your account from another country and asks you to confirm your identity right now. It wants your password, a one-time code, and sometimes your card details. Fear and speed are the engine. Slow down and open the service by typing its address yourself.<\/p>\n<h2 id=\"warning-signs-on-the-page-and-in-the-message\"><span class=\"ez-toc-section\" id=\"Warning_signs_on_the_page_and_in_the_message\"><\/span>Warning signs on the page and in the message<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>No single sign proves a page is fake, but several together are a strong case. Work through these in order.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793597524380_Five-checks-for-spotting-a-phishing-page.jpeg\" alt=\"Five checks for spotting a phishing page\" title=\"\"><\/p>\n<h3 id=\"look-at-the-domain-not-the-page\"><span class=\"ez-toc-section\" id=\"1_Look_at_the_domain_not_the_page\"><\/span>1. Look at the domain, not the page<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Read the address from right to left, up to the first single slash. The part just before the final extension, and the word to its left, is the domain that matters. The Texas Office of the Attorney General advises <a href=\"https:\/\/www.oag.state.tx.us\/consumer-protection\/how-spot-and-report-internet-and-email-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">inspecting URL structure<\/a> for subtle misspellings, unexpected character strings and extra characters at the end of the web address.<\/p>\n<p>On a phone, the address bar may truncate. Press and hold a link to preview the full address before opening it.<\/p>\n<h3 id=\"ask-how-you-got-there\"><span class=\"ez-toc-section\" id=\"2_Ask_how_you_got_there\"><\/span>2. Ask how you got there<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Did you type the address, use a bookmark, or tap a link someone sent you? An unsolicited link is the common thread in nearly every example above. Phishvoid\u2019s checklist asks whether you <a href=\"https:\/\/phishvoid.com\/blog\/phishing-site-examples\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">arrived through an unsolicited link<\/a>, whether the owning domain is wrong, and whether the domain was recently registered.<\/p>\n<h3 id=\"notice-the-emotional-push\"><span class=\"ez-toc-section\" id=\"3_Notice_the_emotional_push\"><\/span>3. Notice the emotional push<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>CISA identifies <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">urgent, emotionally charged or fear-based language<\/a> as a primary indicator, especially when a message claims dire consequences if you do not act. Other signs from the same guidance include requests for personal or financial information, untrusted shortened URLs, and wrong email addresses or links.<\/p>\n<p>CISA also notes that poor grammar is less reliable than it used to be, because AI can produce flawless text. NIST makes the related point that increasingly capable AI can be used to craft convincing attacks, so it recommends <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">taking a second or third look<\/a> at requests for action.<\/p>\n<h3 id=\"check-what-the-page-asks-for\"><span class=\"ez-toc-section\" id=\"4_Check_what_the_page_asks_for\"><\/span>4. Check what the page asks for<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A login page asks for a login. If it also wants your Social Security number, full card details with the security code, or your email password to \u201cverify\u201d another account, stop. Payment pages that appear after a login you never started are another flag.<\/p>\n<h3 id=\"verify-through-a-channel-you-control\"><span class=\"ez-toc-section\" id=\"5_Verify_through_a_channel_you_control\"><\/span>5. Verify through a channel you control<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>NIST advises verifying unsolicited requests by <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">using contact details from the company\u2019s public website<\/a>, not the details inside the suspicious message. In practice: close the message, open a fresh tab, type the company\u2019s address, and sign in there. If the alert was real, it will also be waiting in your account.<\/p>\n<h2 id=\"how-to-tell-a-fake-login-from-a-real-one-in-ten-seconds\"><span class=\"ez-toc-section\" id=\"How_to_tell_a_fake_login_from_a_real_one_in_ten_seconds\"><\/span>How to tell a fake login from a real one in ten seconds<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Use this quick routine whenever a link asks you to sign in or pay.<\/p>\n<ol>\n<li><strong>Pause before clicking.<\/strong> Ask whether you expected this message.<\/li>\n<li><strong>Read the full domain.<\/strong> Find the registered domain and compare it letter by letter with the one you know.<\/li>\n<li><strong>Check the source.<\/strong> Did the link come from an email, text or ad you did not ask for? If so, do not sign in through it.<\/li>\n<li><strong>Go around the link.<\/strong> Type the address or use a bookmark.<\/li>\n<li><strong>Let your tools weigh in.<\/strong> If your password manager does not offer to fill your saved login, that is information. Treat it as a warning, not an inconvenience.<\/li>\n<\/ol>\n<p>That last point matters more than it seems. Password managers match logins to the exact domain they were saved for, so they <a href=\"https:\/\/phishvoid.com\/blog\/phishing-site-examples\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">will not automatically fill credentials<\/a> on an unrecognized look-alike. A human can be fooled by <code>paypa1<\/code>. A matching rule cannot. Our guide to <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/password-manager-tips-you-need-to-know\" target=\"_blank\" rel=\"noopener\">password manager tips<\/a> covers how to get the most from this behavior, and our piece on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/how-secure-are-password-manager-tools\" target=\"_blank\" rel=\"noopener\">how secure password managers are<\/a> explains the protections behind it.<\/p>\n<p>If you have turned off autofill in your browser for other reasons, <a href=\"https:\/\/support.logmeonce.com\/hc\/en-us\/articles\/360010219913-How-to-turn-off-auto-fill-and-built-in-password-manager-in-your-browser\" target=\"_blank\" rel=\"noopener\">this support article<\/a> explains how the built-in manager and a dedicated one can coexist without conflicts.<\/p>\n<h2 id=\"perspective-why-the-domain-check-should-not-rest-on-you-alone\"><span class=\"ez-toc-section\" id=\"Perspective_why_the_domain_check_should_not_rest_on_you_alone\"><\/span>Perspective: why the domain check should not rest on you alone<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<blockquote>\n<p>We build password and identity tools, so we see the same story again and again: the person who fell for a phishing page was not careless. The page was good, the message arrived at a busy moment, and the address looked right at a glance.<\/p>\n<p>That is why we do not think the answer is to ask everyone to be more vigilant all the time. Vigilance runs out. Our approach is to put checks in places that do not get tired. A password manager that fills credentials only on the domain you saved them for. Passwordless MFA, which is designed to reduce how much a stolen password is worth in the first place. Dark web monitoring, which is designed to alert you when your details show up where they should not.<\/p>\n<p>None of this replaces looking at the address bar. It means a single slip does not have to become a breach. If you take one habit from this article, make it this: let the tool refuse to fill, and treat the refusal as a signal to stop.<\/p>\n<p><em>Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"using-phishing-examples-and-simulations-safely\"><span class=\"ez-toc-section\" id=\"Using_phishing_examples_and_simulations_safely\"><\/span>Using phishing examples and simulations safely<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you are an IT lead, teacher or manager, you may want a sample phishing site to train people. Do it in a way that builds trust.<\/p>\n<p>The Centre for Cybersecurity\u2019s playbook recommends <a href=\"https:\/\/www.centreforcybersecurity.com\/toolkit\/phishing-simulation-playbook\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">prior organizational notice<\/a>, written agreement from the owner of the mail system covering sending, allow-listing and dates, a privacy review, and invented, fair lures. It also advises recording only the outcomes you need, never passwords or form text, reporting aggregate results, showing an immediate non-blaming learning page, making reporting easy, and not punishing people for clicking. It suggests announcing that the programme exists and explaining its purpose without revealing dates or lure details.<\/p>\n<p>The UK National Cyber Security Centre adds a reality check: simulations <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">cannot teach users to spot every phishing attempt<\/a>. It recommends reassuring staff that they will not get in trouble for reporting suspected phishing, and warns that asking people to scrutinize every email can be unrealistic and counterproductive. Blame discourages reporting, while a positive security culture encourages it. Resilience needs technology, process and people together.<\/p>\n<p>A few practical rules follow:<\/p>\n<ul>\n<li><strong>Use invented brands or your own.<\/strong> Never clone a real company\u2019s login for training without permission.<\/li>\n<li><strong>Never capture real passwords.<\/strong> Log that someone submitted the form, not what they typed.<\/li>\n<li><strong>Teach on the landing page.<\/strong> The moment after a click is when the lesson sticks. Show the clue they missed.<\/li>\n<li><strong>Measure reporting, not just clicking.<\/strong> A rising report rate is a better sign of health than a falling click rate.<\/li>\n<li><strong>Keep a simple reporting path.<\/strong> One button or one address, no forms.<\/li>\n<\/ul>\n<p>For researchers, documented real-world data exists too. The Piracema repository holds <a href=\"https:\/\/www.nature.com\/articles\/s41598-022-19442-8\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">942,471 phishing records from 2016 to 2021<\/a>, 135,542 of which preserve page source code. Its authors note that phishing databases can be disorganized, inconsistent and limited in balance, and that phishing is volatile: pages vanish quickly, so old snapshots matter.<\/p>\n<h2 id=\"if-you-already-entered-information-on-a-suspicious-site\"><span class=\"ez-toc-section\" id=\"If_you_already_entered_information_on_a_suspicious_site\"><\/span>If you already entered information on a suspicious site<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Act in this order, and do not wait to be sure.<\/p>\n<ol>\n<li><strong>Change the password<\/strong> for that account, and for any other account that used the same one. Reuse turns one leak into many, as we explain in <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/password-reuse-convenient-but-dangerous\" target=\"_blank\" rel=\"noopener\">password reuse: convenient, but dangerous<\/a>. Use a new, unique password from a generator.<\/li>\n<li><strong>Turn on MFA<\/strong> for the account. HHS recommends MFA because it can <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">stop credential-stuffing attacks<\/a> from getting into an account whose login details were exposed. Our page on <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> shows one way to set it up.<\/li>\n<li><strong>Call your bank or card issuer<\/strong> if you typed payment details. CISA\u2019s example describes a victim whose stolen password and credit card were used for purchases, and who <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">recovered most of his losses<\/a> after contacting his bank and the retailer.<\/li>\n<li><strong>Report it.<\/strong> HHS notes that fake websites, emails, malware and other internet scams can be <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">reported to the FBI\u2019s Internet Crime Complaint Center (IC3)<\/a>. At work, tell your IT or security team right away. A fast report protects colleagues who got the same message.<\/li>\n<li><strong>Do not click anything else.<\/strong> If you only suspect a message and have not engaged, CISA\u2019s guidance is to <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">avoid links and attachments and delete it<\/a>.<\/li>\n<\/ol>\n<p>If your email address or password was involved, it is worth checking whether it has appeared in known leaks. Our <a href=\"https:\/\/logmeonce.com\/identity-theft-protection-dark-web-scan-and-monitoring\" target=\"_blank\" rel=\"noopener\">identity theft protection and dark web scan<\/a> page describes how monitoring works.<\/p>\n<h2 id=\"where-a-password-manager-and-mfa-fit\"><span class=\"ez-toc-section\" id=\"Where_a_password_manager_and_MFA_fit\"><\/span>Where a password manager and MFA fit<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Three layers cover most of the ground phishing pages try to exploit.<\/p>\n<ul>\n<li><strong>Unique passwords per site.<\/strong> If a fake page steals one, it opens one door. See our write-up on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/5-warning-signs-youre-using-weak-passwords\" target=\"_blank\" rel=\"noopener\">warning signs of weak passwords<\/a>.<\/li>\n<li><strong>Domain-matched autofill.<\/strong> Saved logins appear only on the right site. Whether browser-saved passwords are enough is a fair question, and we look at it in <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/is-it-safe-to-save-passwords-in-chrome-or-safari\" target=\"_blank\" rel=\"noopener\">is it safe to save passwords in Chrome or Safari<\/a>.<\/li>\n<li><strong>A second factor.<\/strong> Even when a password leaks, a second factor makes it harder to use. Passwordless sign-in goes further by removing the password as the thing to steal.<\/li>\n<\/ul>\n<p>No tool makes anyone invincible, and we do not claim ours does. They narrow the damage a single mistake can do. For a deeper look at the question, read <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/are-password-managers-unhackable\" target=\"_blank\" rel=\"noopener\">are password managers unhackable<\/a>.<\/p>\n<h2 id=\"choosing-a-plan-that-matches-your-risk\"><span class=\"ez-toc-section\" id=\"Choosing_a_plan_that_matches_your_risk\"><\/span>Choosing a plan that matches your risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you want these protections in one place, LogMeOnce offers plans for individuals, families and organizations.<\/p>\n<p>For personal use, the Premium plan is listed at $0.00 per month, Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month on our <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">password manager page<\/a>. Dark Web Monitoring is listed at $1.67 per month, and Family Dark Web Monitoring at $3.34 per month, alongside a Personal plan at $4.00 per month on the <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">pricing and comparison page<\/a>.<\/p>\n<p>For workplaces, Teams is $4.00 per user per month and Business is $7.99 per user per month, with Enterprise available on request, all on the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business pricing page<\/a>. Managed service providers and government teams can see the full product range on our <a href=\"https:\/\/logmeonce.com\/resources\" target=\"_blank\" rel=\"noopener\">resources page<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>Start with the free Premium plan if you want to see domain-matched autofill in action, or compare the tiers if you manage a team.<\/p>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"is-it-legal-to-build-a-sample-phishing-site-for-training\"><span class=\"ez-toc-section\" id=\"Is_it_legal_to_build_a_sample_phishing_site_for_training\"><\/span>Is it legal to build a sample phishing site for training?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It depends on what you copy and who you send it to. Using invented brands or your own organization, with written agreement from whoever owns the mail system, is the approach recommended in the <a href=\"https:\/\/www.centreforcybersecurity.com\/toolkit\/phishing-simulation-playbook\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Centre for Cybersecurity\u2019s playbook<\/a>. Cloning a real company\u2019s login or collecting real passwords creates legal and privacy risk, so involve your legal or compliance team first.<\/p>\n<h3 id=\"does-a-padlock-icon-mean-a-site-is-safe\"><span class=\"ez-toc-section\" id=\"Does_a_padlock_icon_mean_a_site_is_safe\"><\/span>Does a padlock icon mean a site is safe?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. The padlock only means the connection is encrypted, not that the site belongs to who it claims to be. A fake page can be encrypted too. Check the domain and how you arrived instead, as the <a href=\"https:\/\/www.oag.state.tx.us\/consumer-protection\/how-spot-and-report-internet-and-email-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Texas Attorney General\u2019s guidance<\/a> suggests by inspecting the URL itself.<\/p>\n<h3 id=\"can-i-be-harmed-just-by-opening-a-phishing-page\"><span class=\"ez-toc-section\" id=\"Can_I_be_harmed_just_by_opening_a_phishing_page\"><\/span>Can I be harmed just by opening a phishing page?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Opening a page is far less risky than submitting a form or downloading a file, but some fraudulent sites aim to deliver malware, as <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">HHS notes<\/a>. Close the tab, do not download anything, and run a security scan if you are unsure. If you entered credentials, follow the steps above.<\/p>\n<h3 id=\"where-can-i-report-a-phishing-website\"><span class=\"ez-toc-section\" id=\"Where_can_I_report_a_phishing_website\"><\/span>Where can I report a phishing website?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In the U.S., you can report fake websites and scams to the FBI\u2019s <a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Internet Crime Complaint Center<\/a>, as HHS notes. If it impersonates your employer or a service you use, also tell that organization\u2019s security or support team.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.netcraft.com\/blog\/10-real-examples-of-phishing-websites-screenshots\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">10 Real Phishing Websites (Screenshots Included)<\/a><\/li>\n<li><a href=\"https:\/\/www.hhs.gov\/sites\/default\/files\/threats-fraudulent-websites-sector-alert-tlpclear.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Threats from Fraudulent Websites, HHS sector alert<\/a><\/li>\n<li><a href=\"https:\/\/www.netskope.com\/blog\/attackers-target-crypto-wallets-using-codeless-webflow-phishing-pages\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Recognize and Report Phishing, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.oag.state.tx.us\/consumer-protection\/how-spot-and-report-internet-and-email-scams\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How to Spot and Report Internet and Email Scams, Texas Office of the Attorney General<\/a><\/li>\n<li><a href=\"https:\/\/phishvoid.com\/blog\/phishing-site-examples\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing Site Examples: 8 Fake Pages and How to Spot Them<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing, NIST<\/a><\/li>\n<li><a href=\"https:\/\/www.centreforcybersecurity.com\/toolkit\/phishing-simulation-playbook\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">How to run a fair phishing simulation, Centre for Cybersecurity<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing attacks: defending your organisation, NCSC<\/a><\/li>\n<li><a href=\"https:\/\/www.nature.com\/articles\/s41598-022-19442-8\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Piracema: a Phishing snapshot database for building dataset, Scientific Reports<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>See what a sample phishing site looks like, the warning signs in its URL and page, how to tell a fake login from a real one, and what to do if you entered data.<\/p>\n","protected":false},"author":0,"featured_media":248469,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248467","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248467"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248467\/revisions"}],"predecessor-version":[{"id":248468,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248467\/revisions\/248468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248469"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}